
<!doctype html>
<html lang="en" class="no-js">
  <head>
    
      <meta charset="utf-8">
      <meta name="viewport" content="width=device-width,initial-scale=1">
      
        <meta name="description" content="Elastic Security is releasing detection logic for the Dirty Pipe exploit.">
      
      
      
        <link rel="canonical" href="https://elastic.github.io/security-research/intelligence/2022/03/03.dirty-pipe/article/">
      
      
        
      
      <link rel="icon" href="../../../../../assets/img/favicon.ico">
      <meta name="generator" content="mkdocs-1.2.3, mkdocs-material-8.2.4+insiders-4.10.1">
    
    
      
        <title>Detecting and responding to Dirty Pipe with Elastic - Elastic Security Research</title>
      
    
    
      <link rel="stylesheet" href="../../../../../assets/stylesheets/main.589a02ac.min.css">
      
        
        <link rel="stylesheet" href="../../../../../assets/stylesheets/palette.e6a45f82.min.css">
        
      
      
    
    
    
      
        
        
        <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
        <link rel="stylesheet" href="https://fonts.googleapis.com/css?family=Inter:300,300i,400,400i,700,700i%7CRoboto+Mono:400,400i,700,700i&display=fallback">
        <style>:root{--md-text-font:"Inter";--md-code-font:"Roboto Mono"}</style>
      
    
    
      <link rel="stylesheet" href="../../../../../assets/css/extra.css">
    
    <script>__md_scope=new URL("../../../../..",location),__md_hash=e=>[...e].reduce((e,_)=>(e<<5)-e+_.charCodeAt(0),0),__md_get=(e,_=localStorage,t=__md_scope)=>JSON.parse(_.getItem(t.pathname+"."+e)),__md_set=(e,_,t=localStorage,a=__md_scope)=>{try{t.setItem(a.pathname+"."+e,JSON.stringify(_))}catch(e){}}</script>
    
      
  


  
  


  <script id="__analytics">function __md_analytics(){function n(){dataLayer.push(arguments)}window.dataLayer=window.dataLayer||[],n("js",new Date),n("config","G-PP6W2PS48B"),document.addEventListener("DOMContentLoaded",function(){if(document.forms.search&&document.forms.search.query.addEventListener("blur",function(){this.value&&n("event","search",{search_term:this.value})}),document.forms.feedback){var e,a=document.forms.feedback;for(e of a.querySelectorAll("[type=submit]"))e.addEventListener("click",function(e){e.preventDefault();var t=document.location.pathname,e=this.getAttribute("data-md-value");n("event","feedback",{page:t,data:e}),a.firstElementChild.disabled=!0;e=a.querySelector(".md-feedback__note [data-md-value='"+e+"']");e&&(e.hidden=!1)}),a.hidden=!1}"undefined"!=typeof location$&&location$.subscribe(function(e){n("config","G-PP6W2PS48B",{page_path:e.pathname})})});var e=document.createElement("script");e.async=!0,e.src="https://www.googletagmanager.com/gtag/js?id=G-PP6W2PS48B",document.getElementById("__analytics").insertAdjacentElement("afterEnd",e)}</script>

  
    <script>var consent;"undefined"==typeof __md_analytics||(consent=__md_get("__consent"))&&consent.analytics&&__md_analytics()</script>
  

    
    
      
        <meta  property="og:type"  content="website" >
      
        <meta  property="og:title"  content="Detecting and responding to Dirty Pipe with Elastic - Elastic Security Research" >
      
        <meta  property="og:description"  content="Elastic Security is releasing detection logic for the Dirty Pipe exploit." >
      
        <meta  property="og:image"  content="https://elastic.github.io/security-research/assets/images/social/intelligence/2022/03/03.dirty-pipe/article.png" >
      
        <meta  property="og:image:type"  content="image/png" >
      
        <meta  property="og:image:width"  content="1200" >
      
        <meta  property="og:image:height"  content="630" >
      
        <meta  property="og:url"  content="https://elastic.github.io/security-research/intelligence/2022/03/03.dirty-pipe/article/" >
      
        <meta  name="twitter:card"  content="summary_large_image" >
      
        <meta  name="twitter:title"  content="Detecting and responding to Dirty Pipe with Elastic - Elastic Security Research" >
      
        <meta  name="twitter:description"  content="Elastic Security is releasing detection logic for the Dirty Pipe exploit." >
      
        <meta  name="twitter:image"  content="https://elastic.github.io/security-research/assets/images/social/intelligence/2022/03/03.dirty-pipe/article.png" >
      
    
    


  </head>
  
  
    
    
    
    
    
    <body dir="ltr" data-md-color-scheme="elastic" data-md-color-primary="" data-md-color-accent="">
  
    
    
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
      
    
    
    <input class="md-toggle" data-md-toggle="drawer" type="checkbox" id="__drawer" autocomplete="off">
    <input class="md-toggle" data-md-toggle="search" type="checkbox" id="__search" autocomplete="off">
    <label class="md-overlay" for="__drawer"></label>
    <div data-md-component="skip">
      
        
        <a href="#preamble" class="md-skip">
          Skip to content
        </a>
      
    </div>
    <div data-md-component="announce">
      
    </div>
    
    
      

<header class="md-header" data-md-component="header">
  <nav class="md-header__inner md-grid" aria-label="Header">
    <a href="../../../../.." title="Elastic Security Research" class="md-header__button md-logo" aria-label="Elastic Security Research" data-md-component="logo">
      
  <img src="../../../../../assets/img/logo.svg" alt="logo">

    </a>
    <label class="md-header__button md-icon" for="__drawer">
      <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M3 6h18v2H3V6m0 5h18v2H3v-2m0 5h18v2H3v-2z"/></svg>
    </label>
    <div class="md-header__title" data-md-component="header-title">
      <div class="md-header__ellipsis">
        <div class="md-header__topic">
          <span class="md-ellipsis">
            Elastic Security Research
          </span>
        </div>
        <div class="md-header__topic" data-md-component="header-topic">
          <span class="md-ellipsis">
            
              Detecting and responding to Dirty Pipe with Elastic
            
          </span>
        </div>
      </div>
    </div>
    
    
    
      <label class="md-header__button md-icon" for="__search">
        <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.516 6.516 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5z"/></svg>
      </label>
      <div class="md-search" data-md-component="search" role="dialog">
  <label class="md-search__overlay" for="__search"></label>
  <div class="md-search__inner" role="search">
    <form class="md-search__form" name="search">
      <input type="text" class="md-search__input" name="query" aria-label="Search" placeholder="Search" autocapitalize="off" autocorrect="off" autocomplete="off" spellcheck="false" data-md-component="search-query" required>
      <label class="md-search__icon md-icon" for="__search">
        <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M9.5 3A6.5 6.5 0 0 1 16 9.5c0 1.61-.59 3.09-1.56 4.23l.27.27h.79l5 5-1.5 1.5-5-5v-.79l-.27-.27A6.516 6.516 0 0 1 9.5 16 6.5 6.5 0 0 1 3 9.5 6.5 6.5 0 0 1 9.5 3m0 2C7 5 5 7 5 9.5S7 14 9.5 14 14 12 14 9.5 12 5 9.5 5z"/></svg>
        <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11h12z"/></svg>
      </label>
      <nav class="md-search__options" aria-label="Search">
        
        <button type="reset" class="md-search__icon md-icon" aria-label="Clear" tabindex="-1">
          <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M19 6.41 17.59 5 12 10.59 6.41 5 5 6.41 10.59 12 5 17.59 6.41 19 12 13.41 17.59 19 19 17.59 13.41 12 19 6.41z"/></svg>
        </button>
      </nav>
      
    </form>
    <div class="md-search__output">
      <div class="md-search__scrollwrap" data-md-scrollfix>
        <div class="md-search-result" data-md-component="search-result">
          <div class="md-search-result__meta">
            Initializing search
          </div>
          <ol class="md-search-result__list"></ol>
        </div>
      </div>
    </div>
  </div>
</div>
    
    
    
  </nav>
  
</header>
    
    <div class="md-container" data-md-component="container">
      
      
        
          
            
<nav class="md-tabs" aria-label="Tabs" data-md-component="tabs">
  <div class="md-tabs__inner md-grid">
    <ul class="md-tabs__list">
      
        


  
    
    
  
  
    <li class="md-tabs__item">
      <a href="../../../../.." class="md-tabs__link">
        
  
  Elastic Security Research

      </a>
    </li>
  

      
        


  
    
    
      
    
  
  
    
    
    
      <li class="md-tabs__item">
        <a href="../../../../" class="md-tabs__link md-tabs__link--active">
          
  
    
  
  Intelligence Analysis

        </a>
      </li>
    
  

      
        


  
    
    
  
  
    
    
    
      <li class="md-tabs__item">
        <a href="../../../../../malware/" class="md-tabs__link">
          
  
    
  
  Malware Analysis

        </a>
      </li>
    
  

      
        


  
    
    
  
  
    
    
    
      <li class="md-tabs__item">
        <a href="../../../../../whitepapers/" class="md-tabs__link">
          
  
    
  
  Whitepapers

        </a>
      </li>
    
  

      
        


  
    
    
  
  
    
    
    
      <li class="md-tabs__item">
        <a href="../../../../../tools/" class="md-tabs__link">
          
  
    
  
  Tools

        </a>
      </li>
    
  

      
        


  
    
    
  
  
    <li class="md-tabs__item">
      <a href="../../../../../tags/" class="md-tabs__link">
        
  
  Tag Index

      </a>
    </li>
  

      
    </ul>
  </div>
</nav>
          
        
      
      <main class="md-main" data-md-component="main">
        <div class="md-main__inner md-grid">
          
            
              
              <div class="md-sidebar md-sidebar--primary" data-md-component="sidebar" data-md-type="navigation" >
                <div class="md-sidebar__scrollwrap">
                  <div class="md-sidebar__inner">
                    

  


<nav class="md-nav md-nav--primary md-nav--lifted" aria-label="Navigation" data-md-level="0">
  <label class="md-nav__title" for="__drawer">
    <a href="../../../../.." title="Elastic Security Research" class="md-nav__button md-logo" aria-label="Elastic Security Research" data-md-component="logo">
      
  <img src="../../../../../assets/img/logo.svg" alt="logo">

    </a>
    Elastic Security Research
  </label>
  
  <ul class="md-nav__list" data-md-scrollfix>
    
      
      
      


  
  
  
    <li class="md-nav__item">
      <a href="../../../../.." class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Elastic Security Research
  </span>

      </a>
    </li>
  

    
      
      
      


  
  
    
  
  
    
    <li class="md-nav__item md-nav__item--active md-nav__item--nested">
      
      
        <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_2" type="checkbox" id="__nav_2" checked>
      
      
      
      
        <label class="md-nav__link" for="__nav_2">
          
  
  <span class="md-ellipsis">
    Intelligence Analysis
  </span>

          <span class="md-nav__icon md-icon"></span>
        </label>
      
      <nav class="md-nav" aria-label="Intelligence Analysis" data-md-level="1">
        <label class="md-nav__title" for="__nav_2">
          <span class="md-nav__icon md-icon"></span>
          Intelligence Analysis
        </label>
        <ul class="md-nav__list" data-md-scrollfix>
          
            
              
  
  
  
    <li class="md-nav__item">
      <a href="../../../../" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Elastic Intelligence Analysis
  </span>

      </a>
    </li>
  

            
          
            
              
  
  
    
  
  
    
    <li class="md-nav__item md-nav__item--active md-nav__item--nested">
      
      
        <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_2_2" type="checkbox" id="__nav_2_2" checked>
      
      
      
      
        <label class="md-nav__link" for="__nav_2_2">
          
  
  <span class="md-ellipsis">
    2022
  </span>

          <span class="md-nav__icon md-icon"></span>
        </label>
      
      <nav class="md-nav" aria-label="2022" data-md-level="2">
        <label class="md-nav__title" for="__nav_2_2">
          <span class="md-nav__icon md-icon"></span>
          2022
        </label>
        <ul class="md-nav__list" data-md-scrollfix>
          
            
              
  
  
  
    
    <li class="md-nav__item md-nav__item--nested">
      
      
        <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_2_2_1" type="checkbox" id="__nav_2_2_1" >
      
      
      
      
        <label class="md-nav__link" for="__nav_2_2_1">
          
  
  <span class="md-ellipsis">
    January
  </span>

          <span class="md-nav__icon md-icon"></span>
        </label>
      
      <nav class="md-nav" aria-label="January" data-md-level="3">
        <label class="md-nav__title" for="__nav_2_2_1">
          <span class="md-nav__icon md-icon"></span>
          January
        </label>
        <ul class="md-nav__list" data-md-scrollfix>
          
            
              
  
  
  
    <li class="md-nav__item">
      <a href="../../../01/01.formbook-adopts-cabless-approach/article/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    FORMBOOK Adopts CAB-less Approach
  </span>

      </a>
    </li>
  

            
          
            
              
  
  
  
    <li class="md-nav__item">
      <a href="../../../01/02.collecting-cobalt-strike-beacons/article/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Collecting Cobalt Strike Beacons with the Elastic Stack
  </span>

      </a>
    </li>
  

            
          
            
              
  
  
  
    <li class="md-nav__item">
      <a href="../../../01/03.extracting-cobalt-strike-beacon/article/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Extracting Cobalt Strike Beacon Configurations
  </span>

      </a>
    </li>
  

            
          
        </ul>
      </nav>
    </li>
  

            
          
            
              
  
  
    
  
  
    
    <li class="md-nav__item md-nav__item--active md-nav__item--nested">
      
      
        <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_2_2_2" type="checkbox" id="__nav_2_2_2" checked>
      
      
      
      
        <label class="md-nav__link" for="__nav_2_2_2">
          
  
  <span class="md-ellipsis">
    March
  </span>

          <span class="md-nav__icon md-icon"></span>
        </label>
      
      <nav class="md-nav" aria-label="March" data-md-level="3">
        <label class="md-nav__title" for="__nav_2_2_2">
          <span class="md-nav__icon md-icon"></span>
          March
        </label>
        <ul class="md-nav__list" data-md-scrollfix>
          
            
              
  
  
  
    <li class="md-nav__item">
      <a href="../../01.hermeticwiper-targets-ukraine/article/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Elastic protects against data wiper malware targeting Ukraine: HERMETICWIPER
  </span>

      </a>
    </li>
  

            
          
            
              
  
  
  
    <li class="md-nav__item">
      <a href="../../02.phoreal-targets-southeast-asia-financial-sector/article/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    PHOREAL Malware Targets the Southeast Asian Financial Sector
  </span>

      </a>
    </li>
  

            
          
            
              
  
  
    
  
  
    <li class="md-nav__item md-nav__item--active">
      
      <input class="md-nav__toggle md-toggle" data-md-toggle="toc" type="checkbox" id="__toc">
      
      
      
        <label class="md-nav__link md-nav__link--active" for="__toc">
          
  
  <span class="md-ellipsis">
    Detecting and responding to Dirty Pipe with Elastic
  </span>

          <span class="md-nav__icon md-icon"></span>
        </label>
      
      <a href="./" class="md-nav__link md-nav__link--active">
        
  
  <span class="md-ellipsis">
    Detecting and responding to Dirty Pipe with Elastic
  </span>

      </a>
      
        

<nav class="md-nav md-nav--secondary" aria-label="Table of contents">
  
  
  
  
    <label class="md-nav__title" for="__toc">
      <span class="md-nav__icon md-icon"></span>
      Table of contents
    </label>
    <ul class="md-nav__list" data-md-component="toc" data-md-scrollfix>
      
        <li class="md-nav__item">
  <a href="#preamble" class="md-nav__link">
    Preamble
  </a>
  
    <nav class="md-nav" aria-label="Preamble">
      <ul class="md-nav__list">
        
          <li class="md-nav__item">
  <a href="#what-is-dirty-pipe-cve-2022-0847" class="md-nav__link">
    What is Dirty Pipe (CVE-2022-0847)?
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#what-is-the-impact" class="md-nav__link">
    What is the impact?
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#what-is-elastic-doing-about-it" class="md-nav__link">
    What is Elastic doing about it?
  </a>
  
</li>
        
      </ul>
    </nav>
  
</li>
      
        <li class="md-nav__item">
  <a href="#dirty-pipe-details" class="md-nav__link">
    Dirty Pipe Details
  </a>
  
    <nav class="md-nav" aria-label="Dirty Pipe Details">
      <ul class="md-nav__list">
        
          <li class="md-nav__item">
  <a href="#linux-pipes-cve-2022-0847" class="md-nav__link">
    Linux Pipes &amp; CVE-2022-0847
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#proof-of-concept-code" class="md-nav__link">
    Proof Of Concept Code
  </a>
  
</li>
        
      </ul>
    </nav>
  
</li>
      
        <li class="md-nav__item">
  <a href="#finding-systems-vulnerable-to-dirty-pipe" class="md-nav__link">
    Finding systems vulnerable to Dirty Pipe
  </a>
  
    <nav class="md-nav" aria-label="Finding systems vulnerable to Dirty Pipe">
      <ul class="md-nav__list">
        
          <li class="md-nav__item">
  <a href="#using-the-elastic-security-integration" class="md-nav__link">
    Using the Elastic Security Integration
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#using-the-osquery-manager-integration" class="md-nav__link">
    Using the Osquery Manager Integration
  </a>
  
</li>
        
      </ul>
    </nav>
  
</li>
      
        <li class="md-nav__item">
  <a href="#detecting-cve-2022-0847-exploitation-using-auditd" class="md-nav__link">
    Detecting CVE-2022-0847 exploitation using Auditd
  </a>
  
    <nav class="md-nav" aria-label="Detecting CVE-2022-0847 exploitation using Auditd">
      <ul class="md-nav__list">
        
          <li class="md-nav__item">
  <a href="#auditd-rules" class="md-nav__link">
    Auditd rules
  </a>
  
</li>
        
      </ul>
    </nav>
  
</li>
      
        <li class="md-nav__item">
  <a href="#linux-auditing-system-event-collection-with-elastic" class="md-nav__link">
    Linux Auditing System event collection with Elastic
  </a>
  
    <nav class="md-nav" aria-label="Linux Auditing System event collection with Elastic">
      <ul class="md-nav__list">
        
          <li class="md-nav__item">
  <a href="#the-elastic-agent-wauditd-integration" class="md-nav__link">
    The Elastic Agent w/Auditd Integration
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#auditbeat" class="md-nav__link">
    Auditbeat
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#filebeat" class="md-nav__link">
    Filebeat
  </a>
  
</li>
        
      </ul>
    </nav>
  
</li>
      
        <li class="md-nav__item">
  <a href="#detecting-dirty-pipe-with-elastic" class="md-nav__link">
    Detecting Dirty Pipe with Elastic
  </a>
  
    <nav class="md-nav" aria-label="Detecting Dirty Pipe with Elastic">
      <ul class="md-nav__list">
        
          <li class="md-nav__item">
  <a href="#hunt-queries-in-kibana" class="md-nav__link">
    Hunt queries in Kibana
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#detection-engine-alerts" class="md-nav__link">
    Detection Engine alerts
  </a>
  
</li>
        
      </ul>
    </nav>
  
</li>
      
        <li class="md-nav__item">
  <a href="#respond-to-observed-threats" class="md-nav__link">
    Respond to Observed Threats
  </a>
  
</li>
      
        <li class="md-nav__item">
  <a href="#defense-in-depth-recommendations" class="md-nav__link">
    Defense in Depth Recommendations
  </a>
  
</li>
      
        <li class="md-nav__item">
  <a href="#references" class="md-nav__link">
    References¶
  </a>
  
</li>
      
    </ul>
  
</nav>
      
    </li>
  

            
          
        </ul>
      </nav>
    </li>
  

            
          
        </ul>
      </nav>
    </li>
  

            
          
        </ul>
      </nav>
    </li>
  

    
      
      
      


  
  
  
    
    <li class="md-nav__item md-nav__item--nested">
      
      
        <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_3" type="checkbox" id="__nav_3" >
      
      
      
      
        <label class="md-nav__link" for="__nav_3">
          
  
  <span class="md-ellipsis">
    Malware Analysis
  </span>

          <span class="md-nav__icon md-icon"></span>
        </label>
      
      <nav class="md-nav" aria-label="Malware Analysis" data-md-level="1">
        <label class="md-nav__title" for="__nav_3">
          <span class="md-nav__icon md-icon"></span>
          Malware Analysis
        </label>
        <ul class="md-nav__list" data-md-scrollfix>
          
            
              
  
  
  
    <li class="md-nav__item">
      <a href="../../../../../malware/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Elastic Malware Analysis
  </span>

      </a>
    </li>
  

            
          
            
              
  
  
  
    
    <li class="md-nav__item md-nav__item--nested">
      
      
        <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_3_2" type="checkbox" id="__nav_3_2" >
      
      
      
      
        <label class="md-nav__link" for="__nav_3_2">
          
  
  <span class="md-ellipsis">
    2022
  </span>

          <span class="md-nav__icon md-icon"></span>
        </label>
      
      <nav class="md-nav" aria-label="2022" data-md-level="2">
        <label class="md-nav__title" for="__nav_3_2">
          <span class="md-nav__icon md-icon"></span>
          2022
        </label>
        <ul class="md-nav__list" data-md-scrollfix>
          
            
              
  
  
  
    
    <li class="md-nav__item md-nav__item--nested">
      
      
        <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_3_2_1" type="checkbox" id="__nav_3_2_1" >
      
      
      
      
        <label class="md-nav__link" for="__nav_3_2_1">
          
  
  <span class="md-ellipsis">
    January
  </span>

          <span class="md-nav__icon md-icon"></span>
        </label>
      
      <nav class="md-nav" aria-label="January" data-md-level="3">
        <label class="md-nav__title" for="__nav_3_2_1">
          <span class="md-nav__icon md-icon"></span>
          January
        </label>
        <ul class="md-nav__list" data-md-scrollfix>
          
            
              
  
  
  
    <li class="md-nav__item">
      <a href="../../../../../malware/2022/01/01.operation-bleeding-bear/article/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Operation Bleeding Bear
  </span>

      </a>
    </li>
  

            
          
        </ul>
      </nav>
    </li>
  

            
          
        </ul>
      </nav>
    </li>
  

            
          
        </ul>
      </nav>
    </li>
  

    
      
      
      


  
  
  
    
    <li class="md-nav__item md-nav__item--nested">
      
      
        <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_4" type="checkbox" id="__nav_4" >
      
      
      
      
        <label class="md-nav__link" for="__nav_4">
          
  
  <span class="md-ellipsis">
    Whitepapers
  </span>

          <span class="md-nav__icon md-icon"></span>
        </label>
      
      <nav class="md-nav" aria-label="Whitepapers" data-md-level="1">
        <label class="md-nav__title" for="__nav_4">
          <span class="md-nav__icon md-icon"></span>
          Whitepapers
        </label>
        <ul class="md-nav__list" data-md-scrollfix>
          
            
              
  
  
  
    <li class="md-nav__item">
      <a href="../../../../../whitepapers/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Elastic Whitepapers
  </span>

      </a>
    </li>
  

            
          
            
              
  
  
  
    
    <li class="md-nav__item md-nav__item--nested">
      
      
        <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_4_2" type="checkbox" id="__nav_4_2" >
      
      
      
      
        <label class="md-nav__link" for="__nav_4_2">
          
  
  <span class="md-ellipsis">
    2022
  </span>

          <span class="md-nav__icon md-icon"></span>
        </label>
      
      <nav class="md-nav" aria-label="2022" data-md-level="2">
        <label class="md-nav__title" for="__nav_4_2">
          <span class="md-nav__icon md-icon"></span>
          2022
        </label>
        <ul class="md-nav__list" data-md-scrollfix>
          
            
              
  
  
  
    
    <li class="md-nav__item md-nav__item--nested">
      
      
        <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_4_2_1" type="checkbox" id="__nav_4_2_1" >
      
      
      
      
        <label class="md-nav__link" for="__nav_4_2_1">
          
  
  <span class="md-ellipsis">
    February
  </span>

          <span class="md-nav__icon md-icon"></span>
        </label>
      
      <nav class="md-nav" aria-label="February" data-md-level="3">
        <label class="md-nav__title" for="__nav_4_2_1">
          <span class="md-nav__icon md-icon"></span>
          February
        </label>
        <ul class="md-nav__list" data-md-scrollfix>
          
            
              
  
  
  
    <li class="md-nav__item">
      <a href="../../../../../whitepapers/2022/02/02.sandboxing-antimalware-products-for-fun-and-profit/article/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Sandboxing Antimalware Products for Fun and Profit
  </span>

      </a>
    </li>
  

            
          
            
              
  
  
  
    <li class="md-nav__item">
      <a href="../../../../../whitepapers/2022/02/03.exploring-windows-uac-bypass-techniques-detection-strategies/article/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Exploring Windows UAC Bypasses: Techniques and Detection Strategies
  </span>

      </a>
    </li>
  

            
          
        </ul>
      </nav>
    </li>
  

            
          
        </ul>
      </nav>
    </li>
  

            
          
            
              
  
  
  
    
    <li class="md-nav__item md-nav__item--nested">
      
      
        <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_4_3" type="checkbox" id="__nav_4_3" >
      
      
      
      
        <label class="md-nav__link" for="__nav_4_3">
          
  
  <span class="md-ellipsis">
    2021
  </span>

          <span class="md-nav__icon md-icon"></span>
        </label>
      
      <nav class="md-nav" aria-label="2021" data-md-level="2">
        <label class="md-nav__title" for="__nav_4_3">
          <span class="md-nav__icon md-icon"></span>
          2021
        </label>
        <ul class="md-nav__list" data-md-scrollfix>
          
            
              
  
  
  
    
    <li class="md-nav__item md-nav__item--nested">
      
      
        <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_4_3_1" type="checkbox" id="__nav_4_3_1" >
      
      
      
      
        <label class="md-nav__link" for="__nav_4_3_1">
          
  
  <span class="md-ellipsis">
    July
  </span>

          <span class="md-nav__icon md-icon"></span>
        </label>
      
      <nav class="md-nav" aria-label="July" data-md-level="3">
        <label class="md-nav__title" for="__nav_4_3_1">
          <span class="md-nav__icon md-icon"></span>
          July
        </label>
        <ul class="md-nav__list" data-md-scrollfix>
          
            
              
  
  
  
    <li class="md-nav__item">
      <a href="../../../../../whitepapers/2021/07/01.threat-intel-filebeat-module/article/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Ingesting threat data with the Threat Intel Filebeat module
  </span>

      </a>
    </li>
  

            
          
        </ul>
      </nav>
    </li>
  

            
          
        </ul>
      </nav>
    </li>
  

            
          
        </ul>
      </nav>
    </li>
  

    
      
      
      


  
  
  
    
    <li class="md-nav__item md-nav__item--nested">
      
      
        <input class="md-nav__toggle md-toggle" data-md-toggle="__nav_5" type="checkbox" id="__nav_5" >
      
      
      
      
        <label class="md-nav__link" for="__nav_5">
          
  
  <span class="md-ellipsis">
    Tools
  </span>

          <span class="md-nav__icon md-icon"></span>
        </label>
      
      <nav class="md-nav" aria-label="Tools" data-md-level="1">
        <label class="md-nav__title" for="__nav_5">
          <span class="md-nav__icon md-icon"></span>
          Tools
        </label>
        <ul class="md-nav__list" data-md-scrollfix>
          
            
              
  
  
  
    <li class="md-nav__item">
      <a href="../../../../../tools/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Research Tools
  </span>

      </a>
    </li>
  

            
          
            
              
  
  
  
    <li class="md-nav__item">
      <a href="../../../../../tools/cobalt-strike-extractor/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Cobalt Strike Beacon Extractor
  </span>

      </a>
    </li>
  

            
          
        </ul>
      </nav>
    </li>
  

    
      
      
      


  
  
  
    <li class="md-nav__item">
      <a href="../../../../../tags/" class="md-nav__link">
        
  
  <span class="md-ellipsis">
    Tag Index
  </span>

      </a>
    </li>
  

    
  </ul>
</nav>
                  </div>
                </div>
              </div>
            
            
              
              <div class="md-sidebar md-sidebar--secondary" data-md-component="sidebar" data-md-type="toc" >
                <div class="md-sidebar__scrollwrap">
                  <div class="md-sidebar__inner">
                    

<nav class="md-nav md-nav--secondary" aria-label="Table of contents">
  
  
  
  
    <label class="md-nav__title" for="__toc">
      <span class="md-nav__icon md-icon"></span>
      Table of contents
    </label>
    <ul class="md-nav__list" data-md-component="toc" data-md-scrollfix>
      
        <li class="md-nav__item">
  <a href="#preamble" class="md-nav__link">
    Preamble
  </a>
  
    <nav class="md-nav" aria-label="Preamble">
      <ul class="md-nav__list">
        
          <li class="md-nav__item">
  <a href="#what-is-dirty-pipe-cve-2022-0847" class="md-nav__link">
    What is Dirty Pipe (CVE-2022-0847)?
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#what-is-the-impact" class="md-nav__link">
    What is the impact?
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#what-is-elastic-doing-about-it" class="md-nav__link">
    What is Elastic doing about it?
  </a>
  
</li>
        
      </ul>
    </nav>
  
</li>
      
        <li class="md-nav__item">
  <a href="#dirty-pipe-details" class="md-nav__link">
    Dirty Pipe Details
  </a>
  
    <nav class="md-nav" aria-label="Dirty Pipe Details">
      <ul class="md-nav__list">
        
          <li class="md-nav__item">
  <a href="#linux-pipes-cve-2022-0847" class="md-nav__link">
    Linux Pipes &amp; CVE-2022-0847
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#proof-of-concept-code" class="md-nav__link">
    Proof Of Concept Code
  </a>
  
</li>
        
      </ul>
    </nav>
  
</li>
      
        <li class="md-nav__item">
  <a href="#finding-systems-vulnerable-to-dirty-pipe" class="md-nav__link">
    Finding systems vulnerable to Dirty Pipe
  </a>
  
    <nav class="md-nav" aria-label="Finding systems vulnerable to Dirty Pipe">
      <ul class="md-nav__list">
        
          <li class="md-nav__item">
  <a href="#using-the-elastic-security-integration" class="md-nav__link">
    Using the Elastic Security Integration
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#using-the-osquery-manager-integration" class="md-nav__link">
    Using the Osquery Manager Integration
  </a>
  
</li>
        
      </ul>
    </nav>
  
</li>
      
        <li class="md-nav__item">
  <a href="#detecting-cve-2022-0847-exploitation-using-auditd" class="md-nav__link">
    Detecting CVE-2022-0847 exploitation using Auditd
  </a>
  
    <nav class="md-nav" aria-label="Detecting CVE-2022-0847 exploitation using Auditd">
      <ul class="md-nav__list">
        
          <li class="md-nav__item">
  <a href="#auditd-rules" class="md-nav__link">
    Auditd rules
  </a>
  
</li>
        
      </ul>
    </nav>
  
</li>
      
        <li class="md-nav__item">
  <a href="#linux-auditing-system-event-collection-with-elastic" class="md-nav__link">
    Linux Auditing System event collection with Elastic
  </a>
  
    <nav class="md-nav" aria-label="Linux Auditing System event collection with Elastic">
      <ul class="md-nav__list">
        
          <li class="md-nav__item">
  <a href="#the-elastic-agent-wauditd-integration" class="md-nav__link">
    The Elastic Agent w/Auditd Integration
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#auditbeat" class="md-nav__link">
    Auditbeat
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#filebeat" class="md-nav__link">
    Filebeat
  </a>
  
</li>
        
      </ul>
    </nav>
  
</li>
      
        <li class="md-nav__item">
  <a href="#detecting-dirty-pipe-with-elastic" class="md-nav__link">
    Detecting Dirty Pipe with Elastic
  </a>
  
    <nav class="md-nav" aria-label="Detecting Dirty Pipe with Elastic">
      <ul class="md-nav__list">
        
          <li class="md-nav__item">
  <a href="#hunt-queries-in-kibana" class="md-nav__link">
    Hunt queries in Kibana
  </a>
  
</li>
        
          <li class="md-nav__item">
  <a href="#detection-engine-alerts" class="md-nav__link">
    Detection Engine alerts
  </a>
  
</li>
        
      </ul>
    </nav>
  
</li>
      
        <li class="md-nav__item">
  <a href="#respond-to-observed-threats" class="md-nav__link">
    Respond to Observed Threats
  </a>
  
</li>
      
        <li class="md-nav__item">
  <a href="#defense-in-depth-recommendations" class="md-nav__link">
    Defense in Depth Recommendations
  </a>
  
</li>
      
        <li class="md-nav__item">
  <a href="#references" class="md-nav__link">
    References¶
  </a>
  
</li>
      
    </ul>
  
</nav>
                  </div>
                </div>
              </div>
            
          
          <div class="md-content" data-md-component="content">
            <article class="md-content__inner md-typeset">
              
                

  

  <nav class="md-tags" >
    
      
        <a href="../../../../../tags/#dirty-pipe" class="md-tag">
          Dirty Pipe
        </a>
      
    
      
        <a href="../../../../../tags/#cve-2022-0847" class="md-tag">
          CVE-2022-0847
        </a>
      
    
  </nav>



  <h1>Detecting and responding to Dirty Pipe with Elastic</h1>


<aside class="mdx-author" markdown>
  <p>
  
  
  <img alt="@DefSecSentinel" src="https://avatars.githubusercontent.com/u/48036388?v=4" class="avatar" />
  
  
  
  <img alt="@sbousseaden" src="https://avatars.githubusercontent.com/u/20989958?v=4" class="avatar" />
  
  
  
  <img alt="@jtnk" src="https://avatars.githubusercontent.com/u/18609142?v=4" class="avatar" />
  
  
  
  <img alt="@peasead" src="https://avatars.githubusercontent.com/u/7442091?v=4" class="avatar" />
  
  
  </p>
  <p>
    <span>
    
      <strong>Colson Wilhoit</strong> · <a class="magiclink magiclink-github magiclink-mention" href="https://github.com/DefSecSentinel" title="GitHub User: DefSecSentinel">@DefSecSentinel</a>
       | 
    
      <a class="magiclink magiclink-github magiclink-mention" href="https://github.com/sbousseaden" title="GitHub User: sbousseaden">@sbousseaden</a>
       | 
    
      <a class="magiclink magiclink-github magiclink-mention" href="https://github.com/jtnk" title="GitHub User: jtnk">@jtnk</a>
       | 
    
      <strong>Andrew Pease</strong> · <a class="magiclink magiclink-github magiclink-mention" href="https://github.com/peasead" title="GitHub User: peasead">@peasead</a>
      
    
    </span>
    <span>
      <span class="twemoji"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path fill-rule="evenodd" d="M6.75 0a.75.75 0 0 1 .75.75V3h9V.75a.75.75 0 0 1 1.5 0V3h2.75c.966 0 1.75.784 1.75 1.75v16a1.75 1.75 0 0 1-1.75 1.75H3.25a1.75 1.75 0 0 1-1.75-1.75v-16C1.5 3.784 2.284 3 3.25 3H6V.75A.75.75 0 0 1 6.75 0zm-3.5 4.5a.25.25 0 0 0-.25.25V8h18V4.75a.25.25 0 0 0-.25-.25H3.25zM21 9.5H3v11.25c0 .138.112.25.25.25h17.5a.25.25 0 0 0 .25-.25V9.5z"></path></svg></span>
      2022-03-14
      </span>
  </p>
</aside>


<h2 id="preamble">Preamble<a class="headerlink" href="#preamble" title="Permanent link">&para;</a></h2>
<p>Dirty Pipe is a local privilege escalation vulnerability that is easily exploitable with a handful of working exploit POCs already available. Its broad scope (any user-readable file and affected Linux versions) along with its evolving nature (the SUID shell backdoor exploit) make CVE-2022-0847 especially dangerous for administrators of systems that are potentially vulnerable.</p>
<h3 id="what-is-dirty-pipe-cve-2022-0847">What is Dirty Pipe (CVE-2022-0847)?<a class="headerlink" href="#what-is-dirty-pipe-cve-2022-0847" title="Permanent link">&para;</a></h3>
<p><a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0847">CVE-2022-0847</a> is a Linux local privilege escalation vulnerability, discovered by security researcher Max Kellermann that takes advantage of the way the Linux kernel manages page files and named pipes allowing for the overwriting of data in read-only files. This vulnerability impacts Linux kernels 5.8 and later until any version before 5.16.11, 5.15.25, and 5.10.102.</p>
<h3 id="what-is-the-impact">What is the impact?<a class="headerlink" href="#what-is-the-impact" title="Permanent link">&para;</a></h3>
<p>With many POC’s already released, this vulnerability can be easily exploited to gain root-level privileges by, for instance, rewriting sensitive files like “<code>/etc/passwd</code>” or hijacking a SUID root binary (like <code>sudo</code>) via injection of malicious code</p>
<h3 id="what-is-elastic-doing-about-it">What is Elastic doing about it?<a class="headerlink" href="#what-is-elastic-doing-about-it" title="Permanent link">&para;</a></h3>
<p>Elastic is releasing detection logic and <code>Auditd</code> rules that can be used to detect exploitation of this vulnerability.</p>
<h2 id="dirty-pipe-details">Dirty Pipe Details<a class="headerlink" href="#dirty-pipe-details" title="Permanent link">&para;</a></h2>
<p>The vulnerability can be exploited due to a flaw in the new pipe buffer structure where a flag member lacked proper initialization and could then contain a stale value. This could then be used to write to pages within the page cache behind read-only files, allowing for privilege escalation. Given the specific nature of this vulnerability, detection can be quite difficult.</p>
<h3 id="linux-pipes-cve-2022-0847">Linux Pipes &amp; CVE-2022-0847<a class="headerlink" href="#linux-pipes-cve-2022-0847" title="Permanent link">&para;</a></h3>
<p><a href="https://man7.org/linux/man-pages/man2/pipe.2.html">Pipes</a> are an interprocess communication mechanism represented as a file within Linux that can receive input data and provide an output for that data. The output of one process can become the input of another using a “pipe” to forward that data between.</p>
<p>Pipes are managed by the CPU in memory and their data is referred to as a “page”.</p>
<p>The exploitation of this vulnerability utilizes a process called “page splicing”. Page splicing is used to merge data between different pipe pages in memory without having to rewrite the data.</p>
<p>The flag we referenced in the summary is the <code>PIPE_BUF_FLAG_CAN_MERGE</code> flag. This must be set in order for a page cache to be merged and is only set when the pipe page becomes full. Howerver, if the page cache is emptied completely this flag remains (lack of initialization) which is where the problem lies.</p>
<p>The exploit functions generally by:</p>
<ol>
<li>Opening a new pipe</li>
<li>Filling the pipe’s page cache with arbitrary data in order to set the <code>PIPE_BUF_FLAG_CAN_MERGE</code> flag</li>
<li>Draining the page cache of data but retaining the <code>PIPE_BUF_FLAG_CAN_MERGE</code> flag and replacing the data with the new data they want to overwrite a read-only file with</li>
<li>The splice (“page splicing”) <a href="https://man7.org/linux/man-pages/man2/syscalls.2.html">syscall</a> is then used to merge the pages (the pipe page and target file page) leading to the new data being added to a target file bypassing the read-only permissions</li>
</ol>
<p>Many of the exploit POCs observed so far target the <code>/etc/passwd</code> file to overwrite and provide the users with elevated root privileges. Other variants of the exploit released allow for the creation of a SUID shell backdoor by overwriting a binary that has SUID permissions (superuser capabilities) giving the user a root shell and complete control.</p>
<p>We anticipate that adversaries and researchers will develop a multitude of other exploitation chains with this particular vulnerability.</p>
<h3 id="proof-of-concept-code">Proof Of Concept Code<a class="headerlink" href="#proof-of-concept-code" title="Permanent link">&para;</a></h3>
<p>The security community has developed a multitude of different tests that adversaries may take advantage of in future attacks against systems. POCs listed below are authored to help security researchers identify if systems are impacted by the vulnerability, and furthermore - test detection strategies.</p>
<ul>
<li>Original Max Kellermann write-up: <a href="https://dirtypipe.cm4all.com/">https://dirtypipe.cm4all.com/</a></li>
<li>SUID shell: ​​<a href="https://haxx.in/files/dirtypipez.c">https://haxx.in/files/dirtypipez.c</a></li>
<li>Passwd overwrite: <a href="https://github.com/liamg/traitor">https://github.com/liamg/traitor</a></li>
<li>Passwd overwrite: ​​<a href="https://github.com/imfiver/CVE-2022-0847">https://github.com/imfiver/CVE-2022-0847</a></li>
<li>Metasploit module: <a href="https://github.com/rapid7/metasploit-framework/pull/16303">https://github.com/rapid7/metasploit-framework/pull/16303</a></li>
</ul>
<h2 id="finding-systems-vulnerable-to-dirty-pipe">Finding systems vulnerable to Dirty Pipe<a class="headerlink" href="#finding-systems-vulnerable-to-dirty-pipe" title="Permanent link">&para;</a></h2>
<p>Beyond using a traditional vulnerabilty scanner, there are several ways to detect systems vulnerable to Dirty Pipe.</p>
<h3 id="using-the-elastic-security-integration">Using the Elastic Security Integration<a class="headerlink" href="#using-the-elastic-security-integration" title="Permanent link">&para;</a></h3>
<p>If you have Auditbeat, Filebeat (with the Auditd module enabled), or the Elastic Agent (with the Security or Auditd integrations deployed) you can use the Lens visualization tool (located in Kibana) to quickly compile and save a list of vulnerable systems as evidenced in the screenshot below:</p>
<figure>
<p><img alt="Analyzing your infrastructure for kernel versions impacted by Dirty Pipe" src="../media/image7.png" title="Analyzing your infrastructure for kernel versions impacted by Dirty Pipe" /></p>
<figcaption>Analyzing your infrastructure for kernel versions impacted by Dirty Pipe</figcaption>
</figure>
<h3 id="using-the-osquery-manager-integration">Using the Osquery Manager Integration<a class="headerlink" href="#using-the-osquery-manager-integration" title="Permanent link">&para;</a></h3>
<p>Additionally, you can use the <a href="https://docs.elastic.co/en/integrations/osquery_manager">Osquery Manager integration</a> to collect the kernel information from all endpoints. To do this, you need to add the Osquery Manager integration to an Elastic Agent policy (Integrations → Osquery Manager → Add Osquery Manager). Once you’ve added the integration, you can perform a simple query: <code>SELECT version FROM kernel_info;</code> which will return the hostname and Linux kernel version from all endpoints with the policy.</p>
<figure>
<p><img alt="Using Osquery Manager to collect kernel versions" src="../media/image3.png" title="Using Osquery Manager to collect kernel versions" /></p>
<figcaption>Using Osquery Manager to collect kernel versions</figcaption>
</figure>
<h2 id="detecting-cve-2022-0847-exploitation-using-auditd">Detecting CVE-2022-0847 exploitation using Auditd<a class="headerlink" href="#detecting-cve-2022-0847-exploitation-using-auditd" title="Permanent link">&para;</a></h2>
<p><a href="https://linux.die.net/man/8/auditd"><code>Auditd</code></a> is the userspace component of the Linux Auditing System. Auditd stands for Audit Daemon and is a background running service responsible for collecting and writing log files to disk. The Linux Audit System includes a kernel component that hooks system calls and communicates those to <code>Auditd</code>. <code>Auditd</code> is capable of logging System Calls, File Access, and certain pre-configured Audit events.</p>
<p>You can install and enable <code>Auditd</code> for free with the package manager on your Linux distribution of choice.</p>
<h3 id="auditd-rules">Auditd rules<a class="headerlink" href="#auditd-rules" title="Permanent link">&para;</a></h3>
<p><code>Auditd</code> rules define what is to be captured and logged. These rules are generally defined in an <code>audit.rules</code> file and placed at <code>/etc/audit/audit.rules</code> or <code>/etc/audit/rules.d/audit.rules</code>. Events are written to <code>/var/log/audit/audit.log</code> on the local system.</p>
<p>Once you have installed and enabled Auditd, you can add the below lines to your <code>audit.rules</code> file to detect Dirty Pipe exploitation attempts.</p>
<div class="highlight"><span class="filename">Dirty Pipe Auditd rules</span><pre><span></span><code><a id="__codelineno-0-1" name="__codelineno-0-1" href="#__codelineno-0-1"></a>-a always,exit -F <span class="nv">arch</span><span class="o">=</span>b64 -S splice -F <span class="nv">a0</span><span class="o">=</span>0x3 -F <span class="nv">a2</span><span class="o">=</span>0x5 -F <span class="nv">a3</span><span class="o">=</span>0x0 -F <span class="nv">key</span><span class="o">=</span>dirtypipe
<a id="__codelineno-0-2" name="__codelineno-0-2" href="#__codelineno-0-2"></a>-a always,exit -F <span class="nv">arch</span><span class="o">=</span>b64 -S splice -F <span class="nv">a0</span><span class="o">=</span>0x6 -F <span class="nv">a2</span><span class="o">=</span>0x8 -F <span class="nv">a3</span><span class="o">=</span>0x0 -F <span class="nv">key</span><span class="o">=</span>dirtypipe
<a id="__codelineno-0-3" name="__codelineno-0-3" href="#__codelineno-0-3"></a>-a always,exit -F <span class="nv">arch</span><span class="o">=</span>b64 -S splice -F <span class="nv">a0</span><span class="o">=</span>0x7 -F <span class="nv">a2</span><span class="o">=</span>0x9 -F <span class="nv">a3</span><span class="o">=</span>0x0 -F <span class="nv">key</span><span class="o">=</span>dirtypipe
</code></pre></div>
<div class="admonition note">
<p class="admonition-title">Note</p>
<p>The aforementioned rules were adapted by Elastic Security from initial findings by <a href="https://twitter.com/jonasl/status/1501840914381258756">Jonas LeJon</a>.</p>
</div>
<h2 id="linux-auditing-system-event-collection-with-elastic">Linux Auditing System event collection with Elastic<a class="headerlink" href="#linux-auditing-system-event-collection-with-elastic" title="Permanent link">&para;</a></h2>
<p>There are a few different ways to collect Linux Auditing System events using Elastic. You can either use the Elastic Agent with the Auditd integration, Auditbeat, or the Auditd module for Filebeat.</p>
<div class="admonition info">
<p class="admonition-title">Info</p>
<p>Remember, if you&rsquo;re using the Auditd integrations for the Elastic Agent or Filebeat, you&rsquo;ll need to create the <a href="https://elastic.github.io/security-research/intelligence/2022/03/03.dirty-pipe/article/#auditd-rules">Auditd rules described above</a>.</p>
</div>
<h3 id="the-elastic-agent-wauditd-integration">The Elastic Agent w/Auditd Integration<a class="headerlink" href="#the-elastic-agent-wauditd-integration" title="Permanent link">&para;</a></h3>
<p>The Elastic Agent with the <a href="https://docs.elastic.co/en/integrations/auditd">Auditd Integration</a> allows for the collection of Auditd rules. To collect these events, you need to add the Auditd integration to an Elastic Agent policy (Integrations → Auditd → Add Auditd).</p>
<figure>
<p><img alt="Elastic Agent Auditd integration" src="../media/image6.png" title="Elastic Agent Auditd integration" /></p>
<figcaption>Elastic Agent Auditd integration</figcaption>
</figure>
<p>Once this integration is installed to an Elastic Agent policy and deployed to endpoints, you will see Auditd events populated in Kibana.</p>
<p>You can verify that you are receiving Auditd events in Kibana by using the Kibana query <code>event.dataset : "auditd.log"</code>.</p>
<h3 id="auditbeat">Auditbeat<a class="headerlink" href="#auditbeat" title="Permanent link">&para;</a></h3>
<p>You can use the <a href="https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-module-auditd.html">Auditbeat Auditd module</a> to collect the Linux Audit Framework logs. To do this, <a href="https://www.elastic.co/guide/en/beats/auditbeat/current/auditbeat-installation-configuration.html">install Auditbeat</a>. You might encounter errors if another process besides Auditbeat, such as <code>Auditd</code>, is registered to receive data from the Linux Audit Framework. To prevent this conflict, you can stop and disable Auditd from running.</p>
<div class="highlight"><span class="filename">Stopping and disabling Auditd</span><pre><span></span><code><a id="__codelineno-1-1" name="__codelineno-1-1" href="#__codelineno-1-1"></a>sudo service auditd.service stop
<a id="__codelineno-1-2" name="__codelineno-1-2" href="#__codelineno-1-2"></a>sudo chkconfig auditd.service off
</code></pre></div>
<p>Edit the <code>/etc/auditbeat/auditbeat.yml</code> file to point to your local, remote, or cloud cluster and add the Dirty Pipe rules provided above in the Auditd rules section.</p>
<div class="highlight"><span class="filename">Adding Dirty Pipe detection rules to the Auditbeat configuration file</span><pre><span></span><code><a id="__codelineno-2-1" name="__codelineno-2-1" href="#__codelineno-2-1"></a><span class="c1"># ===== Modules configuration =====</span><span class="w"></span>
<a id="__codelineno-2-2" name="__codelineno-2-2" href="#__codelineno-2-2"></a>
<a id="__codelineno-2-3" name="__codelineno-2-3" href="#__codelineno-2-3"></a><span class="nt">auditbeat.modules</span><span class="p">:</span><span class="w"></span>
<a id="__codelineno-2-4" name="__codelineno-2-4" href="#__codelineno-2-4"></a>
<a id="__codelineno-2-5" name="__codelineno-2-5" href="#__codelineno-2-5"></a><span class="nt">* module</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">auditd</span><span class="w"></span>
<a id="__codelineno-2-6" name="__codelineno-2-6" href="#__codelineno-2-6"></a>
<a id="__codelineno-2-7" name="__codelineno-2-7" href="#__codelineno-2-7"></a><span class="c1"># Load audit rules from separate files. Same format as audit.rules(7)</span><span class="w"></span>
<a id="__codelineno-2-8" name="__codelineno-2-8" href="#__codelineno-2-8"></a>
<a id="__codelineno-2-9" name="__codelineno-2-9" href="#__codelineno-2-9"></a><span class="w">  </span><span class="nt">audit_rule_files</span><span class="p">:</span><span class="w"> </span><span class="p p-Indicator">[</span><span class="w"> </span><span class="s">&#39;${path.config}/audit.rules.d/*.conf&#39;</span><span class="w"> </span><span class="p p-Indicator">]</span><span class="w"></span>
<a id="__codelineno-2-10" name="__codelineno-2-10" href="#__codelineno-2-10"></a><span class="w">  </span><span class="nt">audit_rules</span><span class="p">:</span><span class="w"> </span><span class="p p-Indicator">|</span><span class="w"></span>
<a id="__codelineno-2-11" name="__codelineno-2-11" href="#__codelineno-2-11"></a>
<a id="__codelineno-2-12" name="__codelineno-2-12" href="#__codelineno-2-12"></a><span class="c1">## Define audit rules here</span><span class="w"></span>
<a id="__codelineno-2-13" name="__codelineno-2-13" href="#__codelineno-2-13"></a>
<a id="__codelineno-2-14" name="__codelineno-2-14" href="#__codelineno-2-14"></a><span class="c1">## Create file watches (-w) or syscall audits (-a or -A). Uncomment these</span><span class="w"></span>
<a id="__codelineno-2-15" name="__codelineno-2-15" href="#__codelineno-2-15"></a>
<a id="__codelineno-2-16" name="__codelineno-2-16" href="#__codelineno-2-16"></a><span class="c1">## examples or add your own rules</span><span class="w"></span>
<a id="__codelineno-2-17" name="__codelineno-2-17" href="#__codelineno-2-17"></a>
<a id="__codelineno-2-18" name="__codelineno-2-18" href="#__codelineno-2-18"></a><span class="w">    </span><span class="l l-Scalar l-Scalar-Plain">-a always,exit -F arch=b64 -S splice -F a0=0x3 -F a2=0x5 -F a3=0x0 -F key=dirtypipe</span><span class="w"></span>
<a id="__codelineno-2-19" name="__codelineno-2-19" href="#__codelineno-2-19"></a><span class="w">    </span><span class="l l-Scalar l-Scalar-Plain">-a always,exit -F arch=b64 -S splice -F a0=0x6 -F a2=0x8 -F a3=0x0 -F key=dirtypipe</span><span class="w"></span>
<a id="__codelineno-2-20" name="__codelineno-2-20" href="#__codelineno-2-20"></a><span class="w">    </span><span class="l l-Scalar l-Scalar-Plain">-a always,exit -F arch=b64 -S splice -F a0=0x7 -F a2=0x9 -F a3=0x0 -F key=dirtypipe</span><span class="w"></span>
<a id="__codelineno-2-21" name="__codelineno-2-21" href="#__codelineno-2-21"></a>
<a id="__codelineno-2-22" name="__codelineno-2-22" href="#__codelineno-2-22"></a><span class="l l-Scalar l-Scalar-Plain">…truncated…</span><span class="w"></span>
</code></pre></div>
<p>Check the configuration and connectivity of Auditbeat using the <code>test</code> commands</p>
<div class="highlight"><span class="filename">Testing the Auditbeat configuration and output settings</span><pre><span></span><code><a id="__codelineno-3-1" name="__codelineno-3-1" href="#__codelineno-3-1"></a>sudo auditbeat <span class="nb">test</span> config
<a id="__codelineno-3-2" name="__codelineno-3-2" href="#__codelineno-3-2"></a>sudo auditbeat <span class="nb">test</span> output
</code></pre></div>
<p>Run the Auditbeat setup command using <code>sudo auditbeat setup</code>.</p>
<p>Start Auditbeat using <code>sudo systemctl start auditbeat.service</code></p>
<p>Now you should be able to verify events are being populated in the <code>auditbeat-*</code> Data View within Kibana.</p>
<figure>
<p><img alt="Auditbeat Data View in Kibana" src="../media/image4.png" title="Auditbeat Data View in Kibana" /></p>
<figcaption>Auditbeat Data View in Kibana</figcaption>
</figure>
<h3 id="filebeat">Filebeat<a class="headerlink" href="#filebeat" title="Permanent link">&para;</a></h3>
<p>You can use the <a href="https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-module-auditd.html">Auditd module for Filebeat</a> to collect the Auditd logs as well. To do this, <a href="https://www.elastic.co/guide/en/beats/filebeat/current/filebeat-installation-configuration.html">install Filebeat</a> and then enable the Auditd module</p>
<p><code>sudo filebeat modules enable auditd</code> </p>
<p>Next, go into the Auditd configuration file and enable log collection, test, setup, and then start Filebeat.</p>
<div class="highlight"><span class="filename">Enabling Auditd log in the Filebeat configuration file</span><pre><span></span><code><a id="__codelineno-4-1" name="__codelineno-4-1" href="#__codelineno-4-1"></a><span class="l l-Scalar l-Scalar-Plain">sudo vi /etc/filebeat/modules.d/auditd.yml</span><span class="w"></span>
<a id="__codelineno-4-2" name="__codelineno-4-2" href="#__codelineno-4-2"></a>
<a id="__codelineno-4-3" name="__codelineno-4-3" href="#__codelineno-4-3"></a><span class="l l-Scalar l-Scalar-Plain"># Module</span><span class="p p-Indicator">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">auditd</span><span class="w"></span>
<a id="__codelineno-4-4" name="__codelineno-4-4" href="#__codelineno-4-4"></a>
<a id="__codelineno-4-5" name="__codelineno-4-5" href="#__codelineno-4-5"></a><span class="c1"># Docs: &lt;https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-module-auditd.html&gt;</span><span class="w"></span>
<a id="__codelineno-4-6" name="__codelineno-4-6" href="#__codelineno-4-6"></a>
<a id="__codelineno-4-7" name="__codelineno-4-7" href="#__codelineno-4-7"></a><span class="nt">* module</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">auditd</span><span class="w"></span>
<a id="__codelineno-4-8" name="__codelineno-4-8" href="#__codelineno-4-8"></a><span class="w">  </span><span class="l l-Scalar l-Scalar-Plain">log</span><span class="p p-Indicator">:</span><span class="w"></span>
<a id="__codelineno-4-9" name="__codelineno-4-9" href="#__codelineno-4-9"></a><span class="w">    </span><span class="nt">enabled</span><span class="p">:</span><span class="w"> </span><span class="l l-Scalar l-Scalar-Plain">true</span><span class="w"></span>
<a id="__codelineno-4-10" name="__codelineno-4-10" href="#__codelineno-4-10"></a>
<a id="__codelineno-4-11" name="__codelineno-4-11" href="#__codelineno-4-11"></a><span class="c1"># Set custom paths for the log files. If left empty</span><span class="w"></span>
<a id="__codelineno-4-12" name="__codelineno-4-12" href="#__codelineno-4-12"></a>
<a id="__codelineno-4-13" name="__codelineno-4-13" href="#__codelineno-4-13"></a><span class="c1"># Filebeat will choose the paths depending on your OS</span><span class="w"></span>
<a id="__codelineno-4-14" name="__codelineno-4-14" href="#__codelineno-4-14"></a>
<a id="__codelineno-4-15" name="__codelineno-4-15" href="#__codelineno-4-15"></a><span class="w">    </span><span class="c1">#var.paths:</span><span class="w"></span>
</code></pre></div>
<div class="highlight"><span class="filename">Testing the Filebeat configuration and output settings</span><pre><span></span><code><a id="__codelineno-5-1" name="__codelineno-5-1" href="#__codelineno-5-1"></a>sudo filebeat <span class="nb">test</span> config
<a id="__codelineno-5-2" name="__codelineno-5-2" href="#__codelineno-5-2"></a>sudo filebeat <span class="nb">test</span> output
</code></pre></div>
<p>Run the Filebeat setup command using <code>sudo filebeat setup</code>.</p>
<p>Start Filebeat using <code>sudo systemctl start filebeat.service</code></p>
<h2 id="detecting-dirty-pipe-with-elastic">Detecting Dirty Pipe with Elastic<a class="headerlink" href="#detecting-dirty-pipe-with-elastic" title="Permanent link">&para;</a></h2>
<p>Now that Linux Audit Framework events are being populated by either the Elastic Agent, Auditbeat, or Filebeat, you can run queries to detect exploitation attempts using the Kibana Query Language (KQL) in Discover or the Endpoint Query Language (EQL) in Kibana’s Security → Timelines → New Timeline → Correlation query editor.</p>
<h3 id="hunt-queries-in-kibana">Hunt queries in Kibana<a class="headerlink" href="#hunt-queries-in-kibana" title="Permanent link">&para;</a></h3>
<p>KQL query compatible with using the Elastic Agent, Auditbeat, or Filebeat:</p>
<div class="highlight"><span class="filename">KQL query to detect Dirty Pipe exploitation attempts</span><pre><span></span><code><a id="__codelineno-6-1" name="__codelineno-6-1" href="#__codelineno-6-1"></a>auditd.log.key : dirtypipe and process.name : *
</code></pre></div>
<p>EQL query compatible with using the Auditbeat:</p>
<div class="highlight"><span class="filename">EQL query to detect Dirty Pipe exploitation attempts</span><pre><span></span><code><a id="__codelineno-7-1" name="__codelineno-7-1" href="#__codelineno-7-1"></a><span class="n">process</span><span class="w"> </span><span class="k">where</span><span class="w"> </span><span class="n">tags</span><span class="w"> </span><span class="o">:</span><span class="w"> </span><span class="s">&quot;dirtypipe&quot;</span><span class="w"> </span><span class="ow">and</span><span class="w"> </span><span class="ow">not</span><span class="w"> </span><span class="n">process</span><span class="p">.</span><span class="n">name</span><span class="w"> </span><span class="o">:</span><span class="w"> </span><span class="s">&quot;&quot;</span><span class="w"></span>
</code></pre></div>
<h3 id="detection-engine-alerts">Detection Engine alerts<a class="headerlink" href="#detection-engine-alerts" title="Permanent link">&para;</a></h3>
<p>You can also create a Detection Engine alert to monitor for exploitation attempts.</p>
<figure>
<p><img alt="Dirty Pipe Detection Rule" src="../media/image2.png" title="Dirty Pipe Detection Rule" /></p>
<figcaption>Dirty Pipe Detection Rule</figcaption>
</figure>
<p>Exploitation attempts will be recorded in the Kibana Security Solution in the Alerts section.</p>
<figure>
<p><img alt="A preview of alerts created pertaining to the log keys created by Auditd" src="../media/image5.png" title="A preview of alerts created pertaining to the log keys created by Auditd" /></p>
<figcaption>A preview of alerts created pertaining to the log keys created by Auditd</figcaption>
</figure>
<h2 id="respond-to-observed-threats">Respond to Observed Threats<a class="headerlink" href="#respond-to-observed-threats" title="Permanent link">&para;</a></h2>
<p>Elastic makes it easy to quickly respond to a threat by isolating the host while still allowing it to communicate with your stack in order to continue monitoring actions taken and/or remediate the threat.</p>
<figure>
<p><img alt="In-platform capabilities of Elastic Security demonstrating response capabilities" src="../media/image1.png" title="In-platform capabilities of Elastic Security demonstrating response capabilities" /></p>
<figcaption>In-platform capabilities of Elastic Security demonstrating response capabilities</figcaption>
</figure>
<h2 id="defense-in-depth-recommendations">Defense in Depth Recommendations<a class="headerlink" href="#defense-in-depth-recommendations" title="Permanent link">&para;</a></h2>
<p>The following steps can be leveraged to improve a network’s protective posture:</p>
<ol>
<li>Review and ensure that you have deployed the latest stable and vendor-supplied kernel for your OS’</li>
<li>Review and implement the above detection logic within your environment using technology described in the post</li>
<li>Maintain backups of your critical systems to aid in quick recovery</li>
</ol>
<h2 id="references">References¶<a class="headerlink" href="#references" title="Permanent link">&para;</a></h2>
<p>The following research was referenced throughout the document:</p>
<ul>
<li>Exploit CVE reference: <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0847">CVE-2022-0847</a></li>
<li>Write-up using eBPF for some detections: <a href="https://sysdig.com/blog/cve-2022-0847-dirty-pipe-sysdig/">https://sysdig.com/blog/cve-2022-0847-dirty-pipe-sysdig</a></li>
<li>Original Max Kellermann write-up: <a href="https://dirtypipe.cm4all.com/">https://dirtypipe.cm4all.com/</a></li>
<li>SUID shell: ​​<a href="https://haxx.in/files/dirtypipez.c">https://haxx.in/files/dirtypipez.c</a></li>
<li>Passwd overwrite: <a href="https://github.com/liamg/traitor">https://github.com/liamg/traitor</a></li>
<li>Passwd overwrite: ​​<a href="https://github.com/imfiver/CVE-2022-0847">https://github.com/imfiver/CVE-2022-0847</a></li>
<li>Metasploit module: <a href="https://github.com/rapid7/metasploit-framework/pull/16303">https://github.com/rapid7/metasploit-framework/pull/16303</a></li>
<li>Original Auditd detection logic: <a href="https://twitter.com/jonasl/status/1501840914381258756?s=20&amp;t=MIWwwXpl5t0JiopVxX5M5Q">https://twitter.com/jonasl/status/1501840914381258756?s=20&amp;t=MIWwwXpl5t0JiopVxX5M5Q</a></li>
</ul>


  <hr>
<div class="md-source-file">
  <small>
    
      Last update:
      <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">March 15, 2022</span>
      
        <br>
        Created:
        <span class="git-revision-date-localized-plugin git-revision-date-localized-plugin-date">March 14, 2022</span>
      
    
  </small>
</div>

              
            </article>
            
          </div>
        </div>
        
      </main>
      
        <footer class="md-footer">
  
    <nav class="md-footer__inner md-grid" aria-label="Footer">
      
        
        <a href="../../02.phoreal-targets-southeast-asia-financial-sector/article/" class="md-footer__link md-footer__link--prev" aria-label="Previous: PHOREAL Malware Targets the Southeast Asian Financial Sector" rel="prev">
          <div class="md-footer__button md-icon">
            <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11h12z"/></svg>
          </div>
          <div class="md-footer__title">
            <div class="md-ellipsis">
              <span class="md-footer__direction">
                Previous
              </span>
              PHOREAL Malware Targets the Southeast Asian Financial Sector
            </div>
          </div>
        </a>
      
      
        
        <a href="../../../../../malware/" class="md-footer__link md-footer__link--next" aria-label="Next: Elastic Malware Analysis" rel="next">
          <div class="md-footer__title">
            <div class="md-ellipsis">
              <span class="md-footer__direction">
                Next
              </span>
              Elastic Malware Analysis
            </div>
          </div>
          <div class="md-footer__button md-icon">
            <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M4 11v2h12l-5.5 5.5 1.42 1.42L19.84 12l-7.92-7.92L10.5 5.5 16 11H4z"/></svg>
          </div>
        </a>
      
    </nav>
  
  <div class="md-footer-meta md-typeset">
    <div class="md-footer-meta__inner md-grid">
      <div class="md-copyright">
  
    <div class="md-copyright__highlight">
      &copy; 2022. Elasticsearch B.V. All Rights Reserved
    </div>
  
  
</div>
      
    </div>
  </div>
</footer>
      
    </div>
    <div class="md-dialog" data-md-component="dialog">
      <div class="md-dialog__inner md-typeset"></div>
    </div>
    
      <div class="md-consent" data-md-component="consent" id="__consent" hidden>
        <div class="md-consent__overlay"></div>
        <aside class="md-consent__inner">
          <form class="md-consent__form md-grid md-typeset" name="consent">
            


  

<h4>Cookie consent</h4>
<p>We use cookies to recognize your repeated visits and preferences, as well as to measure the effectiveness of our reports and whether users find what they're searching for. With your consent, you're helping us to make our reporting better.</p>
<input type="checkbox" class="md-toggle" id="__settings">
<div class="md-consent__settings">
  <ul class="task-list">
    
      
        
        
      
      <li class="task-list-item">
        <label class="task-list-control">
          <input type="checkbox" name="analytics" checked>
          <span class="task-list-indicator"></span>
          Google Analytics
        <label>
      </li>
    
  </ul>
</div>
<div class="md-consent__controls">
  <label class="md-button" for="__settings">Manage settings</label>
  <button class="md-button md-button--primary">Accept</button>
</div>
          </form>
        </aside>
      </div>
      <script>var consent=__md_get("__consent");if(consent)for(var input of document.forms.consent.elements)input.name&&(input.checked=consent[input.name]||!1);else"file:"!==location.protocol&&setTimeout(function(){document.querySelector("[data-md-component=consent]").hidden=!1},250);var form=document.forms.consent;form.addEventListener("submit",function(n){n.preventDefault(),__md_set("__consent",Object.fromEntries(Array.from(new FormData(form).keys()).map(function(n){return[n,!0]}))),location.hash="",location.reload()})</script>
    
    <script id="__config" type="application/json">{"base": "../../../../..", "features": ["content.code.annotate", "navigation.tabs"], "translations": {"clipboard.copy": "Copy to clipboard", "clipboard.copied": "Copied to clipboard", "search.config.lang": "en", "search.config.pipeline": "stopWordFilter", "search.config.separator": "[\\s\\-]+", "search.placeholder": "Search", "search.result.placeholder": "Type to start searching", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.term.missing": "Missing", "select.version.title": "Select version"}, "search": "../../../../../assets/javascripts/workers/search.5c9dbbf3.min.js"}</script>
    
    
      <script src="../../../../../assets/javascripts/bundle.8be037b4.min.js"></script>
      
    
  </body>
</html>